A web application security scanner is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses.[1] It performs a black-box test. Unlike source code scanners, web application scanners don't have access to the source code and therefore detect vulnerabilities by actually performing attacks. Web applications have been highly popular since 2000 because they allow users to have an interactive experience on the Internet. Rather than just view static web pages, users are able to create personal accounts, add content, query databases and complete transactions. In the process of providing an interactive experience web applications frequently collect, store and use sensitive personal data to deliver their service. Customers benefit from the convenience of these applications, while tacitly taking on risk that private information stored in web applications will be compromised through hacker attacks, insider leaks etc. According to the Privacy Rights Clearinghouse, more than 18 million customer records have been compromised in 2012 due to insufficient security controls on corporate data and web applications.[2]

Contents

A web application security scanner facilitates the automated review of a web application with the expressed purpose of discovering security vulnerabilities, and are required to comply with various regulatory requirements. Web application scanners can look for a wide variety of vulnerabilities, including:

Web applications security scanners typically rely on fully automated scanning, however a 'hybrid' approach, pioneered by High-Tech Bridge,[4] is emerging which aims to address the issue of false-positive reporting by having humans involved in the assessment process.

Tom's IT Pro has provided short reviews of a number of Web Application Security Scanners[5] and an older (but no longer maintained) list of free and commercially available scanners is available at the Web Application Security Consortium.[6]

Sectool Market provides a more up to date comparison of the cost and features of both open source and commercial scanners.[7]

Free tools are usually not updated with the latest language-specific security flaws contained in recently updated languages; while this might be a minority of vulnerability the competent attackers are expected to try those attacks --- especially if they can learn which language the target website uses.

It's usually not possible to know how good a specific security scanner is if you don't have some security know-how yourself; and small business owners are hard to convince to run at least 5 free tools if the first found nothing.

Attackers could theoretically test their attacks against popular scanning tools in order to find holes in websites made by people who use security scanners excessively (they could for example be a typo away from what the free tools scan for), for purpose of making spam sending botnets. As such at least all the free tools are weak against the competent and broad-targeting attackers.

Botnets and other attacks where the attackers can update the malware on the remaining nonpatched computers are extremely hard to clear off some networks used by a large amount of undisciplined users; such as some university networks who don't teach computers at all.

Because the tool is implementing a dynamic testing method, it cannot cover 100% of the source code of the application and then, the application itself. The penetration tester should look at the coverage of the web application or of its attack surface to know if the tool was configured correctly or was able to understand the web application.

The tool cannot implement all variants of attacks for a given vulnerability. So the tools generally have a predefined list of attacks and do not generate the attack payloads depending on the tested web application.

The tools are usually limited in their understanding of the behavior of applications with dynamic content such as JavaScript, Flash, etc.

These tools don't test for social engineering holes that are plainly obvious to competent attackers.

A recent report found that the top application technologies overlooked by most Web application scanners includes JSON (such as JQuery), REST, and Google WebTookit in AJAX applications, Flash Remoting (AMF) and HTML5, as well as mobile apps and Web Services using JSON and REST. XML-RPC and SOAP technologies used in Web services, and complex workflows such as shopping cart, and XSRF/CSRF tokens were also listed.[8]